Skip to main content
Ben Nadel at CFUNITED 2010 (Landsdown, VA) with: Darrell Rapier
Ben Nadel at CFUNITED 2010 (Landsdown, VA) with: Darrell Rapier

The '..' Characters Are Not Allowed In The Path Parameter For The MapPath Method

Published in Comments (14)

I am covering for someone on vacation was given the task of configuring XStandard on a client site. The web services were not working and when accessed directly, the error they throw is:

The '..' characters are not allowed in the Path parameter for the MapPath method

The client is running off of the ASP version of the web services, not my ColdFusion implementation (again, not my client). This doesn't apply to my ColdFusion version, but, since I do so much Xstandard work, I figure I would post up the reason this happens. It's all about security. If you can put ".." in your MapPath() method, then you can go outside of your web root and I guess that freaks some people out. XStandard PRO needs this though because it uploads files to dynamic paths. So, we must allow ".." characters otherwise, we would never know to where we were uploading.

To remedy this (as taken off of the Fog Creek Software site):

  1. Open IIS Manager, right click and choose properties on your [SITE_NAME] virtual directory (or the website root if [SITE_NAME] is installed at the root.
  2. Click the Home Directory or Virtual Directory tab and choose the 'Configuration' button on that tab.
  3. Click the Options tab and make sure the "Enable parent paths" setting is enabled.

Now, when accessed directly, the web services say: "Status: Ready".

Reader Comments


Thank are the only person on the web with a solution to this obscure 'gotcha'. I am building ASP sites on my WinXP laptop and then deploying on a Win2003 Server. The newer version of IIS on the server adds this security "feature".


This problem may also be solved using Request.ServerVariables("APPL_PHYSICAL_PATH") which returns the path to the root folder.
So, if you want to access a file in a parent directory like ../MyFiles/Image.gif it is ok to write

MyPath = Request.ServerVariables("APPL_PHYSICAL_PATH")+"/MyFiles/Image.gif"


Thanks a million! I was having almost the same problem as Neil Laslett: site developed for use, and working perfectly, on XP, was playing up when I tried to move it to Vista.


Great fix.
It must be horrible (not saying this is what happened) when you have to go fill in for someone, and find the way they do things is totally wrong. And you have to fix all of their misnomers, so that they probably receive the praise for things working 'so well' when they get back.
I've had many a time a situation like that. Well, especially in the corporate environment. At least now I work for myself, but it can still happen with some contracts.


for what its worth, i'd go with kyty's request.servervariables suggestion as enabling parent paths can still (depending on version and configuration) pose a security risk in iis.

I believe in love. I believe in compassion. I believe in human rights. I believe that we can afford to give more of these gifts to the world around us because it costs us nothing to be decent and kind and understanding. And, I want you to know that when you land on this site, you are accepted for who you are, no matter how you identify, what truths you live, or whatever kind of goofy shit makes you feel alive! Rock on with your bad self!
Ben Nadel